skydive-cli 0.6.0-beta.15 → 0.6.0-beta.154

package/dist/js/{client-l6orYfqq.mjs → client-Cxk3khQu.mjs}

@@ -91,7 +91,7 @@ function parseFrame(expectedType, frameBytes) {
 		const parsed = jsonLen ? JSON.parse(textDecoder.decode(frameBytes.subarray(jsonStart, jsonEnd))) : {};
 		if (typeof parsed !== "object" || parsed === null) return null;
 		json = parsed;
-	} catch {
+	} catch (_error) {
 		return null;
 	}
 	return {
@@ -113,6 +113,18 @@ const FRAME = {
 	RESIZE: 17
 };
 const MAX_INPUT_BYTES = 1 * 1024 * 1024;
+/** Upper bound for an exec's `timeoutMs`; larger asks are clamped to this. */
+const MAX_EXEC_TIMEOUT_MS = 1440 * 60 * 1e3;
+/**
+* The exec budget applied when the client sends no `timeoutMs` of its own.
+* Liberal by design — one-shot execs legitimately run installs, builds, and
+* long data pulls — but not absent: without it, the e2b SDK's own default
+* (60s) silently kills anything longer mid-run with an opaque
+* `deadline_exceeded`, which is far below what the CLI's `--timeout` help
+* promises ("the server default (~10 min) applies"). Callers with a bigger
+* budget send an explicit `timeoutMs` (clamped to {@link MAX_EXEC_TIMEOUT_MS}).
+*/
+const DEFAULT_EXEC_TIMEOUT_MS = 600 * 1e3;
 /** Query params for the upgrade URL, from a spec. Inverse of {@link parseStreamSpec}. */
 function streamSpecToQuery(spec) {
 	if (spec.mode === "pty") return {
@@ -124,7 +136,8 @@ function streamSpecToQuery(spec) {
 	if (spec.mode === "exec") return {
 		agentId: spec.agentId,
 		mode: "exec",
-		command: spec.command
+		command: spec.command,
+		...spec.timeoutMs !== void 0 ? { timeoutMs: String(spec.timeoutMs) } : {}
 	};
 	return {
 		agentId: spec.agentId,
@@ -273,7 +286,8 @@ var SandboxStream = class SandboxStream {
 		} : {
 			mode: "exec",
 			agentId: opts.agentId,
-			command: opts.command
+			command: opts.command,
+			...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
 		};
 		const url = new URL(`${wsBase(opts.appUrl)}${SANDBOX_STREAM_PATH}`);
 		for (const [key, value] of Object.entries(streamSpecToQuery(spec))) url.searchParams.set(key, value);
@@ -293,4 +307,4 @@ function toBuffer(data) {
 }
 
 //#endregion
-export { encodeFsRequest as a, decodeFsResponse as i, SANDBOX_STREAM_PATH as n, streamSpecToQuery as r, SandboxStream as t };
+export { FS_MAX_BLOB_BYTES as a, streamSpecToQuery as i, DEFAULT_EXEC_TIMEOUT_MS as n, decodeFsResponse as o, SANDBOX_STREAM_PATH as r, encodeFsRequest as s, SandboxStream as t };

package/dist/js/client-DnezHAcS.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { n as PortalClient, r as RATE_LIMIT_STAND_DOWN_MS, t as AUTH_STAND_DOWN_MS } from "./client-r-o8dD4w.mjs";
+import "./api-BFQ4PQDA.mjs";
+
+export { PortalClient };

package/dist/js/{client-7decrdm4.mjs → client-r-o8dD4w.mjs}

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-BFQ4PQDA.mjs";
 import os from "node:os";
 import { z } from "zod";
@@ -160,7 +161,7 @@ function errorMessage(err) {
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1788972427";
+	return "1792805326";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -579,18 +580,41 @@ var JobManager = class {
 
 //#endregion
 //#region ../portal-daemon/src/client.ts
+const INITIAL_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 1e4;
+const AUTH_STAND_DOWN_MS = 5 * 6e4;
+const AUTH_STAND_DOWN_MESSAGE = "portal sign-in expired — reopen Skydive Desktop (or run `skydive portal open`) to reconnect";
+/**
+* True when the error means the server could not authenticate us: a token-mint
+* failure (HttpError 401) or a WS upgrade rejected at the auth layer. `ws`
+* reports a rejected upgrade as `Unexpected server response: <status>` with no
+* structured status property, so the status is read from the message. A 429 is
+* deliberately NOT an auth failure — see isRateLimited.
+*/
+function isAuthFailure(err) {
+	if (err instanceof HttpError) return err.status === 401;
+	return /Unexpected server response: 401\b/.test(errorMessage(err));
+}
+const RATE_LIMIT_STAND_DOWN_MS = 12e4;
+const RATE_LIMIT_STAND_DOWN_MESSAGE = "portal connection rate limited — retrying in 2 minutes";
+function isRateLimited(err) {
+	if (err instanceof HttpError) return err.status === 429;
+	return /Unexpected server response: 429\b/.test(errorMessage(err));
+}
 const DEFAULT_HEARTBEAT = {
 	intervalMs: 15e3,
 	maxMissed: 2,
 	wakeTickMs: 2e3,
 	wakeGapThresholdMs: 1e4,
 	netWatchTickMs: 2e3,
-	initialBackoffMs: 500,
-	maxBackoffMs: 1e4,
+	initialBackoffMs: INITIAL_BACKOFF_MS,
+	maxBackoffMs: MAX_BACKOFF_MS,
 	supersededBackoffFloorMs: 5e3,
 	flapWindowMs: 6e4,
 	flapMaxStandDowns: 3,
-	flapBackoffMs: 6e4
+	flapBackoffMs: 6e4,
+	authStandDownMs: AUTH_STAND_DOWN_MS,
+	rateLimitStandDownMs: RATE_LIMIT_STAND_DOWN_MS
 };
 /**
 * A cheap fingerprint of the machine's network identity: every non-internal
@@ -670,6 +694,8 @@ var PortalClient = class {
 	machineName = "";
 	friendlyName = "";
 	legacyGrantsChecked = false;
+	authRejected = false;
+	rateLimited = false;
 	wakeWatch = null;
 	lastTick = Date.now();
 	netWatch = null;
@@ -785,6 +811,8 @@ var PortalClient = class {
 		if (this.enabled || this.disposed) return;
 		this.enabled = true;
 		this.error = null;
+		this.authRejected = false;
+		this.rateLimited = false;
 		this.connectLoop();
 	}
 	disable() {
@@ -930,6 +958,7 @@ var PortalClient = class {
 				const token = await this.wsToken();
 				const { healthy, standDown } = await this.runConnection(token);
 				if (standDown) {
+					this.setStatus("stand-down");
 					const now = Date.now();
 					standDowns.push(now);
 					standDowns = standDowns.filter((at) => now - at <= this.heartbeatConfig.flapWindowMs);
@@ -939,11 +968,31 @@ var PortalClient = class {
 					} else backoff = Math.max(Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs), this.heartbeatConfig.supersededBackoffFloorMs);
 					sleepFloor = backoff / 2;
 				} else if (healthy) backoff = this.heartbeatConfig.initialBackoffMs;
-				else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				else if (this.authRejected) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					this.authRejected = false;
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (this.rateLimited) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					this.rateLimited = false;
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			} catch (err) {
 				if (!this.enabled || this.disposed || this.handingOff) break;
-				this.setStatus("error", errorMessage(err));
-				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				if (isAuthFailure(err)) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (isRateLimited(err)) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else {
+					this.setStatus("error", errorMessage(err));
+					backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				}
 			}
 			if (!this.enabled || this.disposed || this.handingOff) break;
 			this.inStandDownSleep = sleepFloor > 0;
@@ -1000,6 +1049,8 @@ var PortalClient = class {
 			};
 			ws.on("open", () => {
 				missed = 0;
+				this.authRejected = false;
+				this.rateLimited = false;
 				this.dialReason = null;
 				this.disconnectedAt = null;
 				this.setStatus("connected");
@@ -1013,6 +1064,14 @@ var PortalClient = class {
 			});
 			ws.on("error", (err) => {
 				this.error = errorMessage(err);
+				if (isAuthFailure(err)) {
+					this.authRejected = true;
+					this.dialReason ??= "portal credentials rejected; standing down";
+				}
+				if (isRateLimited(err)) {
+					this.rateLimited = true;
+					this.dialReason ??= "portal connection rate limited; standing down";
+				}
 			});
 			ws.on("close", (code, reason) => {
 				standDown = code === CLOSE_SUPERSEDED || code === CLOSE_FLAP_COOLDOWN || code === 1e3 && reason.toString() === "superseded";
@@ -1076,4 +1135,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { resolveMachineIdentity as a, isRecord as i, isNewerBuild as n, portalDaemonBuild as r, PortalClient as t };
+export { portalDaemonBuild as a, isNewerBuild as i, PortalClient as n, isRecord as o, RATE_LIMIT_STAND_DOWN_MS as r, resolveMachineIdentity as s, AUTH_STAND_DOWN_MS as t };

package/dist/js/{daemon-CLTmAfBt.mjs → daemon-DpnxS19C.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./client-7decrdm4.mjs";
+import "./client-r-o8dD4w.mjs";
 import "./tls-cert-Rua2oV7n.mjs";
 import "./api-BFQ4PQDA.mjs";
-import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-5HHkFtaF.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-KcZ0CrBB.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-5HHkFtaF.mjs → daemon-KcZ0CrBB.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client-7decrdm4.mjs";
+import { a as portalDaemonBuild, i as isNewerBuild, n as PortalClient, o as isRecord } from "./client-r-o8dD4w.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";
+import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
-import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 
 //#region ../portal-daemon/src/local-protocol.ts
 /**
@@ -66,6 +66,18 @@ function canonicalPortalAppUrl(appUrl) {
 	if (host === "skydive.com" || host === "www.skydive.com" || host === "api.skydive.com") return "https://api.skydive.com";
 	return trimmed;
 }
+/** Prefix every Windows named pipe lives under (the pipe filesystem root). */
+const WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
+/**
+* Whether a daemon control-socket path is a Windows named pipe rather than a
+* Unix-domain-socket FILE. Pipes have no on-disk file: they cannot be
+* `stat`ed, `unlink`ed, or purged by a tmp cleaner, and the OS frees the name
+* the moment the owning server closes — so every file-based lifecycle step
+* (stale-file cleanup, the socket-ownership watch) must be skipped for them.
+*/
+function isNamedPipePath(socketPath) {
+	return socketPath.startsWith(WINDOWS_PIPE_PREFIX);
+}
 /**
 * Per-user, per-app daemon socket + state paths. Scoped by OS user and a hash
 * of the CANONICAL appUrl so two logins or two deployments (prod vs a PR
@@ -73,17 +85,42 @@ function canonicalPortalAppUrl(appUrl) {
 * every alias of one deployment (see {@link canonicalPortalAppUrl}) shares
 * one. Kept under the OS temp dir because Unix socket paths are
 * length-limited (~104 bytes on macOS).
+*
+* On Windows a `node:net` server cannot listen on a filesystem path at all —
+* binding the tmp-dir path fails with EACCES and the daemon dies silently
+* (ANY-7285's Windows facet) — so the socket is a named pipe under
+* `\\.\pipe\`, keyed by the same (user, appUrl-hash) pair. State and log
+* files stay under the temp dir on every platform.
+*
+* Darwin `sockaddr_un.sun_path` is 104 bytes including NUL (103 usable).
+* `os.tmpdir()` on macOS is `$TMPDIR` (`/var/folders/<id>/T`, often ~50
+* chars). Adding `skydive-portal-<user>-<hash>/daemon.sock` overruns that
+* cap: bind() fails, the sidecar handshake still reports the long path, and
+* connect() returns ENOENT (or Go's "path must be shorter than SUN_LEN").
+* Stay in `os.tmpdir()` (do not relocate to `/tmp`) and shorten the leaf
+* when the composed path would blow the cap. Windows named pipes have no
+* sun_path, so they keep the long leaf.
 */
-function daemonPaths(appUrl) {
-	const user = safeSegment(os.userInfo().username || "user");
-	const app = createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12);
-	const dir = path.join(os.tmpdir(), `skydive-portal-${user}-${app}`);
-	return {
+const SUN_PATH_MAX = 103;
+function daemonPaths(appUrl, platform = process.platform) {
+	const parent = os.tmpdir();
+	const key = `skydive-portal-${safeSegment(os.userInfo().username || "user")}-${createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12)}`;
+	const dir = path.join(parent, key);
+	const paths = {
 		dir,
-		socketPath: path.join(dir, "daemon.sock"),
+		socketPath: platform === "win32" ? `${WINDOWS_PIPE_PREFIX}${key}` : path.join(dir, "daemon.sock"),
 		statePath: path.join(dir, "state.json"),
 		logPath: path.join(dir, "daemon.log")
 	};
+	if (platform === "win32" || Buffer.byteLength(paths.socketPath) <= SUN_PATH_MAX) return paths;
+	const short = createHash("sha256").update(`${os.userInfo().username || "user"}\0${canonicalPortalAppUrl(appUrl)}`).digest("hex").slice(0, 12);
+	const shortDir = path.join(parent, `skydive-p-${short}`);
+	return {
+		dir: shortDir,
+		socketPath: path.join(shortDir, "d.sock"),
+		statePath: path.join(shortDir, "state.json"),
+		logPath: path.join(shortDir, "daemon.log")
+	};
 }
 function safeSegment(value) {
 	return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 24) || "user";
@@ -344,6 +381,16 @@ const IDLE_SHUTDOWN_MS = 3e4;
 */
 const SOCKET_WATCH_TICK_MS = 3e4;
 /**
+* Grace window after a server stand-down: the check fires the instant the
+* close lands, but the WINNER's socket bind may still be in flight — a check
+* run at t=0 can see our own still-good socket, conclude we are the owner, and
+* redial into the supersede war the stand-down exists to end. On a
+* stand-down-triggered check, wait this out once and re-stat before
+* concluding ownership. The periodic watch tick runs grace-free (nothing just
+* displaced us there).
+*/
+const STAND_DOWN_GRACE_MS = 1500;
+/**
 * Upper bound an incumbent daemon waits, during a graceful handoff, for the
 * successor to dial out and claim presence before giving up and releasing the
 * slot itself. Comfortably above a normal successor boot + WS dial (a few
@@ -370,12 +417,14 @@ var PortalDaemon = class {
 	socketId = null;
 	socketCheckRunning = false;
 	socketWatchTickMs;
+	standDownGraceMs;
 	exit;
 	constructor(appUrl, options) {
 		this.appUrl = canonicalPortalAppUrl(appUrl);
 		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
 		this.socketWatchTickMs = options?.socketWatchTickMs ?? SOCKET_WATCH_TICK_MS;
+		this.standDownGraceMs = options?.standDownGraceMs ?? STAND_DOWN_GRACE_MS;
 		this.exit = options?.exit ?? (() => process.exit(0));
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
@@ -392,8 +441,10 @@ var PortalDaemon = class {
 				resolve();
 			});
 		});
-		await this.recordSocketIdentity();
-		this.startSocketWatch();
+		if (!isNamedPipePath(this.paths.socketPath)) {
+			await this.recordSocketIdentity();
+			this.startSocketWatch();
+		}
 	}
 	/**
 	* Remember which socket FILE we bound (dev+ino), so the watch can tell "our
@@ -421,24 +472,42 @@ var PortalDaemon = class {
 	*/
 	startSocketWatch() {
 		this.socketWatch = setInterval(() => {
-			if (this.socketCheckRunning) return;
-			this.socketCheckRunning = true;
-			this.checkSocketOwnership().catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
-				this.socketCheckRunning = false;
-			});
+			this.runOwnershipCheck();
 		}, this.socketWatchTickMs);
 		this.socketWatch.unref();
 	}
+	/** One socket-ownership pass, shared by the watch timer (grace-free) and the
+	* client's 'stand-down' state (with grace — see STAND_DOWN_GRACE_MS).
+	*/
+	runOwnershipCheck(graceMs = 0) {
+		if (this.socketCheckRunning) return;
+		this.socketCheckRunning = true;
+		this.checkSocketOwnership(graceMs).catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
+			this.socketCheckRunning = false;
+		});
+	}
 	stopSocketWatch() {
 		if (this.socketWatch) {
 			clearInterval(this.socketWatch);
 			this.socketWatch = null;
 		}
 	}
-	async checkSocketOwnership() {
+	async checkSocketOwnership(graceMs = 0) {
 		if (!this.server || this.handingOff) return;
 		const current = await stat(this.paths.socketPath).catch(() => null);
-		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) return;
+		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) {
+			if (graceMs > 0) {
+				await new Promise((r) => setTimeout(r, graceMs));
+				const recheck = await stat(this.paths.socketPath).catch(() => null);
+				const socketId = this.socketId;
+				if (recheck && socketId && !(recheck.dev === socketId.dev && recheck.ino === socketId.ino)) {
+					this.logInfo("control socket taken over during stand-down grace; standing down");
+					this.standDown();
+					return;
+				}
+			}
+			return;
+		}
 		if (current) {
 			this.logInfo("control socket path is owned by another daemon; standing down");
 			this.standDown();
@@ -490,6 +559,10 @@ var PortalDaemon = class {
 		this.exit();
 	}
 	async clearStaleSocket() {
+		if (isNamedPipePath(this.paths.socketPath)) {
+			if (await isDaemonListening(this.paths.socketPath)) throw new Error("daemon already running");
+			return;
+		}
 		if (!await pathExists(this.paths.socketPath)) return;
 		if (await new Promise((resolve) => {
 			const probe = connect(this.paths.socketPath);
@@ -605,13 +678,23 @@ var PortalDaemon = class {
 			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
 			persistedMachineName: this.persistedMachineName,
 			onMachineName: (name, source) => this.onMachineName(name, source),
-			onState: (state) => {
-				this.lastState = state;
-				this.broadcastState();
-			}
+			onState: (state) => this.handleClientState(state)
 		});
 	}
 	/**
+	* Client state transition. A server stand-down ('stand-down' status — the
+	* superseded/flap-cooldown close, distinguishable from an ordinary close
+	* through the status) runs the ownership check NOW with grace, so a
+	* duplicate that already lost the control socket yields within one server
+	* round trip instead of waiting for the next watch tick and fighting
+	* (supersede war).
+	*/
+	handleClientState(state) {
+		if (state.status === "stand-down") this.runOwnershipCheck(this.standDownGraceMs);
+		this.lastState = state;
+		this.broadcastState();
+	}
+	/**
 	* The identity resolved on connect. Persist the name so a later scutil
 	* failure reuses it instead of adopting the volatile hostname, and log the
 	* source — a `hostname-fallback` after we'd previously registered under
@@ -693,7 +776,7 @@ var PortalDaemon = class {
 			appUrl: this.appUrl,
 			build: portalDaemonBuild(),
 			portal: {
-				status: portal?.status ?? "off",
+				status: portal?.status === "stand-down" ? "connecting" : portal?.status ?? "off",
 				machineName: portal?.machineName ?? "",
 				friendlyName: portal?.friendlyName ?? "",
 				error: portal?.error ?? null,
@@ -786,13 +869,19 @@ var PortalDaemon = class {
 * drains attached clients, who reconnect within ~500ms) and spawn from this
 * binary. Both spawners apply the same rule, so a host converges on the
 * newest installed build with at most one bounce.
+*
+* Returns whether a daemon is actually listening when it's done. A spawned
+* daemon that never binds (its process died on startup — e.g. the Windows
+* EACCES bind failure this used to swallow) resolves `false` so callers can
+* SAY so, instead of silently handing the caller a socket nobody serves and
+* leaving the reconnect loop to spin forever with no visible error.
 */
 async function ensureDaemonRunning(appUrl) {
 	const { socketPath } = daemonPaths(appUrl);
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
-		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemonForHandoff(appUrl) === "failed") return;
+		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return true;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return true;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -806,9 +895,10 @@ async function ensureDaemonRunning(appUrl) {
 		env: process.env
 	}).unref();
 	for (let i = 0; i < 50; i += 1) {
-		if (await isDaemonListening(socketPath)) return;
+		if (await isDaemonListening(socketPath)) return true;
 		await sleep(100);
 	}
+	return false;
 }
 /**
 * Entry the CLI calls when launched with PORTAL_DAEMON_FLAG: become the daemon.
@@ -829,7 +919,7 @@ function startPortalDaemon(appUrl) {
 	return new PortalDaemon(appUrl, null).listen();
 }
 async function isDaemonListening(socketPath) {
-	if (!await pathExists(socketPath)) return false;
+	if (!isNamedPipePath(socketPath) && !await pathExists(socketPath)) return false;
 	return new Promise((resolve) => {
 		const probe = connect(socketPath);
 		probe.on("connect", () => {
@@ -956,7 +1046,7 @@ async function stopDaemon(appUrl) {
 function stateMessage(state, declined) {
 	return {
 		t: "state",
-		status: state.status,
+		status: state.status === "stand-down" ? "connecting" : state.status,
 		machineName: state.machineName,
 		friendlyName: state.friendlyName,
 		error: state.error,

package/dist/js/{daemon-client-BdEu0TK_.mjs → daemon-client-CTWxQ2T9.mjs}

@@ -1,14 +1,21 @@
 #!/usr/bin/env node
-import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-5HHkFtaF.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-KcZ0CrBB.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
 //#region ../portal-daemon/src/daemon-client.ts
+/** Reconnect delay when an established daemon connection drops. */
+const RECONNECT_DELAY_MS = 500;
+/** Base delay between daemon SPAWN retries (doubles per consecutive failure). */
+const START_RETRY_BASE_MS = 2e3;
+/** Consecutive failed spawns before start() stops respawning. */
+const MAX_START_ATTEMPTS = 3;
 var PortalDaemonClient = class {
 	sessionId = randomUUID();
 	socket = null;
 	disposed = false;
 	reconnectTimer = null;
+	startFailures = 0;
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
@@ -21,7 +28,21 @@ var PortalDaemonClient = class {
 	/** Spawn the daemon if needed and attach. Idempotent. */
 	async start() {
 		if (this.disposed) return;
-		await ensureDaemonRunning(this.opts.appUrl);
+		if (!await ensureDaemonRunning(this.opts.appUrl)) {
+			this.startFailures += 1;
+			const exhausted = this.startFailures >= MAX_START_ATTEMPTS;
+			this.opts.onState({
+				status: "error",
+				machineName: "",
+				friendlyName: "",
+				error: exhausted ? "portal daemon failed to start repeatedly; toggle sharing to retry" : "portal daemon failed to start (control socket never came up)",
+				grantedAgentIds: [],
+				declinedAgentIds: []
+			});
+			if (!exhausted) this.scheduleReconnect(START_RETRY_BASE_MS * 2 ** (this.startFailures - 1));
+			return;
+		}
+		this.startFailures = 0;
 		this.connect();
 	}
 	connect() {
@@ -74,12 +95,12 @@ var PortalDaemonClient = class {
 		socket.on("close", onClose);
 		socket.on("error", onClose);
 	}
-	scheduleReconnect() {
+	scheduleReconnect(delayMs = RECONNECT_DELAY_MS) {
 		if (this.disposed || this.reconnectTimer) return;
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
 			this.start();
-		}, 500);
+		}, delayMs);
 		this.reconnectTimer.unref();
 	}
 	onMessage(msg) {
@@ -109,6 +130,10 @@ var PortalDaemonClient = class {
 	/** Turn machine sharing on (the daemon connects the portal). */
 	enable() {
 		this.wantEnabled = true;
+		if (this.startFailures >= MAX_START_ATTEMPTS) {
+			this.startFailures = 0;
+			this.start();
+		}
 		this.send({ t: "enable" });
 	}
 	/** Turn machine sharing off. */

package/dist/js/daemon-client-DG7VEYbY.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-r-o8dD4w.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-KcZ0CrBB.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-CTWxQ2T9.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{install-Fo1riO1w.mjs → install-AaZqKYZR.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { c as version$1 } from "./rest-Benrf1yZ.mjs";
-import { E as getConfigPath } from "./print-C_xW32a6.mjs";
+import { c as version$1 } from "./rest-Bqz92FKU.mjs";
+import { D as getConfigPath } from "./print-KIdHOW60.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -1547,6 +1547,51 @@ function formatMb(bytes) {
 	return `${(bytes / MB).toFixed(1)} MB`;
 }
 
+//#endregion
+//#region src/chat/tui/autowrap.ts
+/**
+* Why the TUI turns the terminal's autowrap off for its lifetime.
+*
+* OpenTUI's incremental cell-diff emitter positions every run with an
+* absolute cursor move — it never relies on the terminal to advance the
+* cursor — but it leaves the terminal's autowrap (DECAWM) enabled. When a
+* run reaches the last column, the host terminal wraps its cursor to column
+* 1 of the next row and paints the run's tail there, into cells owned by a
+* different element. The diff buffer then records the *intended* cells, so
+* those stray bytes are never repainted and unrelated text smears together
+* until a full repaint (a resize). Filed upstream with a repro and root
+* cause: https://github.com/anomalyco/opentui/issues/1187 — unfixed there,
+* the consumer-side fix (verified in numux#115) is to disable DECAWM while
+* the renderer runs. Pane content still wraps, inside OpenTUI's own grid.
+*/
+const AUTOWRAP_OFF = "\x1B[?7l";
+const AUTOWRAP_ON = "\x1B[?7h";
+/** Escape hatch: if any surface turns out to depend on host autowrap. */
+const keepAutowrap = () => Boolean(process.env["SKYDIVE_TUI_AUTOWRAP"]);
+let disabledBy = false;
+/**
+* Disable host autowrap so the diff emitter's runs can never wrap onto the
+* next row. No-op when stdout is not a terminal (piped output, tests) and
+* under `SKYDIVE_TUI_AUTOWRAP`.
+*/
+function disableTerminalAutowrap(stdout = process.stdout) {
+	if (!stdout.isTTY || keepAutowrap() || disabledBy) return;
+	disabledBy = true;
+	stdout.write(AUTOWRAP_OFF);
+}
+/**
+* Restore host autowrap. The terminal mode is a property of the host, so
+* every teardown path must run this even when the renderer cannot finish
+* its own teardown: the renderer's `onDestroy` hook covers renderer-driven
+* exits, and the forced-fallback reset in `hard-exit.ts` carries the
+* restore for a teardown that never got there. Idempotent.
+*/
+function restoreTerminalAutowrap(stdout = process.stdout) {
+	if (!disabledBy) return;
+	disabledBy = false;
+	stdout.write(AUTOWRAP_ON);
+}
+
 //#endregion
 //#region src/crash/install.ts
 let installed = false;
@@ -1566,6 +1611,7 @@ function installCrashHandler(opts = {}) {
 	if (installed) return;
 	installed = true;
 	process.on("uncaughtException", (error) => {
+		restoreTerminalAutowrap();
 		const memory = safeMemory();
 		printFatalNotice(writeCrashReport(buildCrashReport({
 			reason: "uncaughtException",
@@ -1594,4 +1640,4 @@ function printFatalNotice(file, memory) {
 }
 
 //#endregion
-export { installAgentAlias as A, resolveWorkspaceId as B, themeVersion as C, machineOsFromPlatform as D, buildImportSeedPrompt as E, detectShell as F, ensureActiveOrganization as I, getActiveWorkspaceId as L, takenAliasNames as M, SUPPORTED_SHELLS as N, aliasActivationHint as O, defaultInstallEnv as P, getSessionIdentity as R, themeModeFromColorFgBg as S, themesForMode as T, setActiveWorkspace as V, monoTheme as _, WORDMARK as a, themeForMode as b, getAutomaticLogsDir as c, profilingEnabled as d, record as f, findTheme as g, applyTheme as h, MARK_CELLS as i, slugifyAliasName as j, dedupeAliasName as k, maybeStartProfiling as l, DEFAULT_THEME_ID as m, buildCrashReport as n, brandHelpArt as o, writeArtifact as p, writeCrashReport as r, splashFitsWidth as s, installCrashHandler as t, profileDir as u, noColorRequested as v, themes as w, themeMode as x, theme as y, listWorkspaces as z };
+export { aliasActivationHint as A, getSessionIdentity as B, themeMode as C, themesForMode as D, themes as E, SUPPORTED_SHELLS as F, resolveWorkspaceId as H, defaultInstallEnv as I, detectShell as L, installAgentAlias as M, slugifyAliasName as N, buildImportSeedPrompt as O, takenAliasNames as P, ensureActiveOrganization as R, themeForMode as S, themeVersion as T, setActiveWorkspace as U, listWorkspaces as V, applyTheme as _, writeCrashReport as a, noColorRequested as b, brandHelpArt as c, maybeStartProfiling as d, profileDir as f, DEFAULT_THEME_ID as g, writeArtifact as h, buildCrashReport as i, dedupeAliasName as j, machineOsFromPlatform as k, splashFitsWidth as l, record as m, disableTerminalAutowrap as n, MARK_CELLS as o, profilingEnabled as p, restoreTerminalAutowrap as r, WORDMARK as s, installCrashHandler as t, getAutomaticLogsDir as u, findTheme as v, themeModeFromColorFgBg as w, theme as x, monoTheme as y, getActiveWorkspaceId as z };

package/dist/js/{print-sWlw3B6z.mjs → print-ClmJYG9P.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./rest-Benrf1yZ.mjs";
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-C_xW32a6.mjs";
+import "./rest-Bqz92FKU.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-KIdHOW60.mjs";
 import "./billing-blocked-D3l5kJlX.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };